$template sys_json_remote,"\{\"@timestamp\":\"%TIMESTAMP:::date-rfc3339%\",\"fromhost-ip\":\"%fromhost-ip%\",\"hostname\":\"%hostname%\",\"severity\":\"%syslogseverity-text%\",\"facility\":\"%syslogfacility-text%\",\"app-name\":\"%programname%\",\"procid\":\"%procid%\",\"msg\":\"%.sys_msg%\"\}\n"
template(name="json_lines" type="list" option.json="on") {
constant(value="{")
constant(value="\"@timestamp\":\"")
property(name="timereported" dateFormat="rfc3339")
constant(value="\",\"timestamp\":\"")
property(name="timereported" dateFormat="rfc3339")
constant(value="\",\"msg\":\"")
property(name="msg")
constant(value="\",\"hostname\":\"")
property(name="hostname")
constant(value="\",\"severity\":\"")
property(name="syslogseverity-text")
constant(value="\",\"facility\":\"")
property(name="syslogfacility-text")
constant(value="\",\"app-name\":\"")
property(name="programname")
constant(value="\",\"procid\":\"")
property(name="procid")
constant(value="\"}\n")
}

 

发表评论

邮箱地址不会被公开。 必填项已用*标注